CVE-2026-54364
MediumCVSS 6.5Summary
CentreStack before version 17.4 contains a session variable injection vulnerability that allows unauthenticated attackers to inject arbitrary session variables by embedding newline and tab characters into a crafted AccountName parameter posted to the SelectProvider.aspx endpoint. Attackers can exploit the lack of input sanitization in the custom session serialization format to inject a resellerid session variable, bypassing the IsValidRSession authentication check and gaining unauthorized access to management pages.
Risk Assessment
The risk includes unauthorized access to the CentreStack management panel, potentially leading to system takeover and data leakage.
Recommendation
It is recommended to immediately upgrade CentreStack to version 17.4 or later, which includes a fix for this vulnerability.
Other vulnerabilities in CentreStack
See all- CVE-2026-54368High
CentreStack before 17.4 contains a SQL injection vulnerability in GladDBFiles.SearchEx() and SearchExUnder(). An authenticated attacker can supply a crafted x-glad-filter header via the jsondir API endpoint, leading to arbitrary SQL execution and file writes using PostgreSQL functions, enabling remote code execution.
- CVE-2026-54367High
CentreStack before 17.2 contains an authentication bypass vulnerability. An unauthenticated attacker can read, write, or delete arbitrary account settings by exploiting exposed API endpoints lacking authorization checks. Attackers can forge valid encrypted EntAcctId values using a static shared encryption key, enabling enumeration of tenant domains and administrator identities.
- CVE-2026-54366High
CentreStack before 17.4 contains an XML external entity (XXE) injection vulnerability. An unauthenticated attacker can supply a malicious URL to the SharePoint storage configuration handler, causing the server to fetch and parse attacker-controlled XML with external DTD references, leading to exfiltration of files such as Web.config containing database credentials and cryptographic keys.
- CVE-2026-54363Critical
CentreStack before version 17.5 contains a hardcoded cryptographic key vulnerability, allowing unauthenticated attackers to forge arbitrary encrypted tokens by exploiting a static SysNumber value used as entropy for AccessTicket.Encrypt() and AccessTicket.Decrypt(). Attackers can craft valid x-glad-auth headers and call privileged API endpoints such as acquiretenantbackuptoken to obtain a domain administrator IdentityTicket, enabling a complete unauthenticated remote code execution chain.
- CVE-2026-54365High
CentreStack before 17.3 contains an unauthenticated deserialization vulnerability in GSNamespace.dll. An unauthenticated attacker can supply a crafted base64-encoded XML string to exposed API endpoints, triggering creation of arbitrary local OS user accounts via the NetUserAdd Windows API.
Original NVD description (English source)
CentreStack before 17.4 contains a session variable injection vulnerability that allows unauthenticated attackers to inject arbitrary session variables by embedding newline and tab characters into a crafted AccountName parameter posted to the SelectProvider.aspx endpoint. Attackers can exploit the lack of input sanitization in the custom session serialization format to inject a resellerid session variable, bypassing the IsValidRSession authentication check and gaining unauthorized access to management pages.